Revision as of 04:29, 27 July 2012

The output of a memory acquisition tool is a memory image which contains the raw physical memory of a system. A wide variety of tools can be used to search for strings or other patterns in a memory image, but to extract higher-level information about the state of the system a memory analysis tool is required.

The Volatility Framework is a collection of tools, implemented in Python, for the extraction of digital artifacts from volatile memory (RAM) samples. Support for Linux is experimental--see the LinuxMemoryForensics page on the Volatility wiki. (Availability/License: GNU GPL)

Foriana is tool for extraction of information such as the process and modules lists from a RAM image using logical relations between OS structures. (Availability/License: GNU GPL)

Draugr is a Linux memory forensics tool written in Python. (Availability/License: GNU GPL)

Volatilitux is another Linux memory forensics tool written in Python. (Availability/License: GNU GPL)

Second Look: Linux Memory Forensics from Raytheon Pikewerks Corporation can analyze live memory or stored snapshots (physical memory images). It can be used to detect rootkits and other kernel-hooking malware, unauthorized applications and services, and stealthy user-level malware, as well as obtain forensic information about the state of the system. It has command-line and GUI interfaces, and reverse engineering capabilities including built-in disassembly and hexadecimal data views. An online reference kernel repository provides baselines for verification of thousands of distribution stock kernels, while an online pagehash database provides the baselines for verification of hundreds of thousands of Linux software packages. As of April 2012, it supports x86 and x86_64 targets running any 2.6-series kernel and 3-series kernels up to 3.2. (Availability/License: commercial)